APT33Threat actor
- apt 33
- atk35
- bleak ion
- cobalt trinity
- elfin
- g0064
- holmium
- magnallium
- peach sandstorm
- refined kitten
- ta451
Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess APT33 works at the behest of the Iranian government.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io4 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
- T1534Internal Spearphishing
“The group is also known to favor internal spearphishing from already-compromised inboxes – emails from a colleague's account rather than an external sender – with a high success rate, for obvious reasons.”
- T1566.001Spearphishing Attachment
“Spearphishing attachments and links have long been the most popular initial access techniques among most Iran-aligned APT groups, including OilRig and APT33.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“the Iran-nexus APT33, as detailed later in this report).”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“…cute;cnicas de acceso inicial más comunes entre la mayoría de los grupos APT alineados con Irán, incluidos OilRig y APT33.”
-
Cyber fallout from the Iran war: What to have on your radar“…attachments and links have long been the most popular initial access techniques among most Iran-aligned APT groups, including OilRig and APT33.”
-
Catching fish in muddy waters“One of FireEye’s investigations stated that the Nasr Institute was an APT33 contractor and was also involved in DDoS attacks on US banks between 2011 and 2013 as part of a campaign called Operation Ababil.”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- gladiyator[.]tkin 1 report
- 94.23.148[.]194in 1 report
- 192.95.21[.]28in 1 report
- 46.105.84[.]146in 1 report
- 185.162.235[.]182in 1 report
- 09aabd2613d339d90ddbd4b7c09195a9in 1 report
- cfa845995b851aacdf40b8e6a5b87ba7in 1 report
- a61b268e9bc9b7e6c9125cdbfb1c422ain 1 report
- f12bab5541a7d8ef4bbca81f6fc835a3in 1 report
- a066f5b93f4ac85e9adfe5ff3b10bc28in 1 report
- 8a004e93d7ee3b26d94156768bc0839din 1 report
- 0638adf8fb4095d60fbef190a759aa9ein 1 report
- eed599981c097944fa143e7d7f7e17b1in 1 report
- 21aebece73549b3c4355a6060df410e9in 1 report
- 5c6148619abb10bb3789dcfb32f759a6in 1 report
- aselsan.com[.]trin 1 report
- dideo[.]irin 1 report
- videoi[.]irin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.